Disclaimer

NeCoders shall not be held responsible for any cases of software/files being hacked due to the information provided in this article.

General Overview

Welcome back to part 3 of the Building Security Awareness in .Net Assemblies series. In this article, I will share with you the possibility of breaking Strong Named .Net Assemblies. Make sure you have already read through part 1 and 2 before continuing on.

Questions pertaining to Strong Name

I do believe many others have the same doubts as I do on whether Strong Name keys could really protect the assembly from being tampered. I would like to share my doubts with you in this article.

Questions:

Question : Is Strong Name key secure?

Answer : Yes, Strong Name key uses RSA 1024 bit encryption.

Question : Is Strong Name key breakable?

Answer : If you have enough computing power, time and knowledge on how to break RSA, the answer is yes.

Question : Can Strong Name key be removed from .NET assemblies?

Answer : Yes, it can be removed very easily if you know how.

The Demonstration Test machine specifications :

Windows XP Professional Edition SP 1 1

Intel Pentium 4 2.6GHz

256MB DDR-RAM

Visual Studio .Net 2003 Professional Edition

Microsoft .Net Framework 1.1

Download the executable files that come with this article.

Open your Visual Studio .Net 2003 command prompt.

Make sure you are inside the CrackingIL/bin/debug directory.

Type “ildasm CrackingIL.exe /out=CrackingIL.il”.

You must be wondering, why we are repeating what we had done in part 1 and part 2 of the series. If you notice, the way to break Strong Name keys is by manipulating the Intermediate Language. But the problem is in part 2, we did modify the Intermediate Language and at the end when we tried to convert it back to an assembly, we will receive an error. I will explain in detail on which part of the Intermediate Language that you should modified to remove the Strong Name key.

Open up the CrackingIL.il with a text editor. I use notepad.

Take a look at the red boxes. From what I understand, each assemblies like System.Windows.Forms, System and mscorlib contains their own public key token and version number.

Now, does our assembly contain a public key? The answer is yes. Before showing it to you, I will first show you 2 screenshots; one without Strong Name key and one with Strong Name key attached.

Without Strong Name :

With Strong Name :

You will notice that the difference on both sides is that the Strong Name key assembly contains a public key. In order to tamper a Strong Named .Net Assembly, just remove that highlighted section. It will look like this.

Now do some modifications to the existing Intermediate Language. You have to remove the registry checking so it will not prompt you for serial number or license. Look for this code.

Then remove the lines of code from IL_0000 to IL_0075. You should have an output like this.

Now just edit some text to prove that you have hijacked that Strong Named key .Net Assembly. Find the code with the phrase “Welcome to NeCoders” and replace it to “You are being hijacked, Strong Names are useless here”.

Congratulations! You had managed to manipulate .Net assemblies with Strong Name key attached to it.

Conclusion

Again, I hope you find this series of the article to be interesting. There will be more articles under this series, in terms of breaking and securing the .Net assemblies. Do check out article 4 when it is available as it will explaining the many theories in .NET security. This in return should provide you with a better understanding in this topic.

References

None

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

NeCoders shall not be held responsible for any cases of software/files being hacked due to the information provided in this article.

That's like me writing an article "50 Ways To Infiltrate Buildings and Plant Explosives" and including a disclaimer: "RabidKangaroo shall not be held responsible for any buildings that are destroyed due to the information provided in this article."

"Those that say a task is impossible shouldn't interrupt the ones who are doing it." - Chinese Proverb

Sorry, but the author is right. Security through obscurity does not work, and that's why even MS publishes deatiled information about vulnerabilities - knowing about a vulnerability in detail is the only true way of knowing if you're in danger and how you can protect yourself.

RabidKangaroo wrote: That's like me writing an article "50 Ways To Infiltrate Buildings and Plant Explosives" and including a disclaimer: "RabidKangaroo shall not be held responsible for any buildings that are destroyed due to the information provided in this article."
RabidKangaroo never entered a building, right? A world where only hackers know how to break code is a world where no one is safe. Good programmers need to know how to break code. Trying hard to break your own code is the first line of defense against hackers.

Daniel Turini wrote:RabidKangaroo never entered a building, right? A world where only hackers know how to break code is a world where no one is safe. Good programmers need to know how to break code. Trying hard to break your own code is the first line of defense against hackers.

I agree with Daniel. To KNOW to do the attack is the best form of protecting. Writing Secure Code[^] among other very useful things, talks exactly about this...

I don't believe there is enough content to provide a 3 part article. You could probably get good reviews (You already are but it could get better) if you condensed the 3 parts into a single part about Strong Names. Also you need to understand, like others have said, that Strong Naming isn't supposed to protected code from highjacking but to provide the ability to strongly name an aseembly for reference abilities. It also provides some other benefits when it comes to the CAS but that could be another article. The reason the hashing exists is to verify that the assembly is the same as it was before so that when an app loads the assembly it can be sure it has the one it is supposed to. If you remove the strong name then an app that references that assembly won't be able to find it thus defeating the purpose of trying to highjack the assembly.

Great article though. I need to get off my butt and submit the ones I have laying around. Kudos to you.

Thanks for your series of articles, they are well written and easy to understand.
I really don't see the point of strong named assemblies after reading this. I didn't think it would be that easy to crack, but I guess, having clear text IL code will always make it easily breakable.
A previous comment said that Strong Named assemblies are just for more reliable referencing. I really had the impression that it was for security, but you have blown that theory sky high!
Thanks

Being in a minority of one, doesn't make you insaneGeorge OrwellHowever, in my case it does

Don't forget this is very simplistic implementation of using strong names for security. A developer fluent in assembler could just as easily do something similar with compiled win32 code.

Strong names are also used for other reason like assigning privileges on a machine/enterprise based on the strong name or public (see Runtime security policy in .Net configuration, many Microsoft assembly are granted special privileges by their public key). .Restrictions can be applied for access to methods/classes in other systems based on public keys by using codeaccess security. (see StrongNameIdentityPermission).

Although as this article demonstrates Strong names could be compromised, if you employ a complete security model these changes can be detected. I would recommend that you sign all code, even if it is only deployed to desktops within your organisation. Security is not so much as preventing tamper completely, but making mechanisms that allow you to detect tamper and take appropriate action to prevent the system being compromised.

Rather than take the author at this word here suggest you get a good book on .Net security. The author is technically correct, his article is informative, but he has assumed that you are only using strong names for a single purpose which is only part of the .Net security model.

Sorry about the rant but as a consultant I often come into organisations where no security has been applied to .Net code, even on public web servers.

.Net code can be made secure, but like any good security system a compromise has to be expected and dealt with appropriately. To assume that you code/System will never be compromised just means you will never know when it is.

ai,ai, I think I got things mixed up: I meant that you can remove the strongname CAS permission check from the security.config, for example to allow non-strongname-complient assemblies to call strong name protected (linkdemand) assemblies/methods. sorry.

No, you restrict certain code being called from 'foreign' assemblies by adding a LinkDemand action on a StrongNameIdentityPermission, for example a library that checks for updates of your application. Only your own assemblies should be able to use that 'call home' assembly; others will receive a security exception. The public key in the codesnippet below comes from the strong name key that has been used to sign all the assemblies.

The permissions are stored in the security.config file. Someone told me a long time ago that if you would remove the permission declaration from this config file, then the permission would not be checked anymore and any assembly, own or foreign, can call the 'protected' method...

Additionally, you can develop your own permissions (like expiration of beta code) and declare it in the security.config file, then the runtime will automatically enforce the permission.

Ok, but I can remove these attributes from the IL if I want, or circumvent them when I'm administrator and set security policies (if I'm not mistaken). They help, but not a lot, as in: protect assembly tampering.

--
Only the true wise understand the difference between knowledge and wisdom.